Frappe has possibility of SQL injection due to improper validations

高危 7.5CVE-2025-30212 · GHSA-3hj6-r5c9-q8f3 · PYSEC-2026-1390 · Published 25/03/2025 · updated 17/06/2026

要点

CVE-2025-30212 是影响 frappe, frappe (frappe) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.44%，高于 38.5% 的漏洞。
修复：升级到 15.51.0, 14.89.0 或更高版本。

Package	Affected versions	Patched versions
frappe PyPI	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`
frappe frappe	`≥ 15.0.0, < 15.51.0< 14.89.0`	`15.51.014.89.0`

Description

Impact

An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information.

Workarounds

Upgrading is required, no other workaround is present.

Credits

Thanks to Thanh of Calif.io for reporting the issue

NVD description

Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.

References

frappe/frappe security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-30212 · ADVISORY
frappe/frappe commit 27f1343 · WEB
frappe/frappe commit 2ebd885 · WEB
frappe/frappe · PACKAGE
pypi.org/project/frappe · PACKAGE
GitHub Advisory GHSA-3hj6-r5c9-q8f3 · ADVISORY

frappe 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

frappe

PyPI

≥ 15.0.0, < 15.51.0< 14.89.0

15.51.014.89.0

frappe

≥ 15.0.0, < 15.51.0< 14.89.0

15.51.014.89.0

Description

Impact

An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information.

Workarounds

Upgrading is required, no other workaround is present.

Credits

Thanks to Thanh of Calif.io for reporting the issue

NVD description

frappe 的其他漏洞

查看全部 →